Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Implementation report: six verifiers written from the v0.2 text alone, run over 2,816 inputs (four findings)

Aperta
  • Qualcosa non va?
#591 4 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
20/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
json, python
Ambito
documentation, security

Direzione di ricerca

Start by reading trace-v0.2.md, especially §§3.1, 3.1.5, 3.3 and the §5 phase table, alongside trace-claim.json; compare these with the conformance vectors and examples named in the report. Reproduce the four findings against the repository verifier and determine which specification clauses or expected verdicts need correction. Done means the text, schema, verifier behavior and vectors agree on the reported cases; the full protocol and per-input tables are not yet linked.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug needs-review:HIGH

Repository state: commit 473045fd (2026-10-18), trace-v0.2.md and trace-claim.json as given in the repo at that commit. Reference used: verify_record from the same commit (installed from source) and, as a second oracle, the PyPI release agentrust-trace 0.11.0.

Method, briefly. Six fresh language-model agents (two runs each of three models) were each given only the two files above and a fixed function interface, were forbidden to read anything else or to use the network (audited from their tool logs), and had to log every point the text did not decide. Their implementations were run with the reference over 133 real records (your conformance vectors, examples, registry entries, two of our intake fixtures), re-signed twins of the 32 records both oracles accept, and single-point mutants of those twins labelled by the clause they probe. Every disagreement was attributed to a clause and classified independently by two raters who saw only the text and the disagreement. This is part of a measurement study across three specifications (RFC 8785 is the control); the full protocol, corpora, implementations and ratings will be posted with a DOI and I will link it here.

Findings, in the order of how much of the corpus they move.

  1. Required fields: text and schema disagree, and the disagreement decides 30% of the corpus. §3.1 says "All fields are required unless marked OPTIONAL" and its table does not mark tool_transcript or transparency; trace-claim.json omits both from required and describes tool_transcript as "OPTIONAL for Phase 1 records"; the §5 phase table lists transparency among Phase 1 fields and tool_transcript from Phase 2; the Authority clause says the schema is the defective artefact when they disagree. No conformance vector or example carries either field. Four of six implementations followed the schema and agree with verify_record on 97.7% of inputs; two followed §3.1 and reject 857 and 1,029 of the 1,035 inputs the reference accepts. Both raters classified this as self-contradicting text. One edit to either side resolves it; as written, the text's own precedence rule points to the side the vectors do not take.

  2. Trust anchor at the signature step. §3.3 step 1 says the binding is verified against the key in cnf. verify_record raises when no trusted key is supplied; four of six implementations, following step 1 literally, verify against the record's own cnf key and accept (32 of 32 such calls), and no implementation refuses for want of an anchor. The text does not say whether a verifier with no external anchor must refuse, or whether a later appraisal step is meant to carry the anchor. If the intent is that a record checked only against its own key is not valid, the text should say so at step 1; if the intent is that the anchor comes from appraisal, the step should say that too. Both raters classified this as silence.

  3. §3.1.5 measurement rule is not enforced by verify_record. Two of the repo's own example records have appraisal.platform_measurement.measurement different from runtime.measurement; the vector envelope expects rejection; all six implementations reject; verify_record at 473045fd accepts, because the rule lives in a separate component that function does not call. Of the 56 vectors carrying an expected verdict, the four schema-side implementations reproduce 56, verify_record 54, the PyPI release 38.

  4. Embedded-form algorithm set. The text lists ES256 for JWT contexts and fixes no algorithm set for the embedded signature form; 32 records with an EC P-256 cnf key and a raw r||s signature are refused by the reference ("unsupported JWK kty 'EC'; expected 'OKP'") and verified by four of six implementations. Both raters: silence.

Also noted: the PyPI release 0.11.0 ships a schema older than the repo's and rejects 21 of the repo's newer example records for an unknown property (platform_measurement), so anyone pinning the release gets different verdicts from anyone pinning the repo; the two oracles differ on 53 of the 2,816 inputs.

What I am not claiming: that any of the six implementations is correct, or that these are vulnerabilities in a deployed verifier. Each is an input on which two readers of the same text reach different verdicts. Happy to share the per-input tables now if useful, and the full package once it has a DOI.

Disclosure: our intake tooling consumes TRACE records (two fixtures above are ours), and we maintain a companion layer for cA2A and a terms layer that judges TRACE records; no product of ours is evaluated in this study.

Lingua principale
Python
Stelle
37
Fork
33
Merge medio
1g 4h
PR unite (30g)
122

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di agentrust-io/trace-spec

Tutte le issue di agentrust-io/trace-spec

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.